Struct ProverProof 

pub struct ProverProof<G, OpeningProof, const FULL_ROUNDS: usize>
where
    G: CommitmentCurve,
    OpeningProof: OpenProof<G, FULL_ROUNDS>,
{
    pub commitments: ProverCommitments<G>,
    pub proof: OpeningProof,
    pub evals: ProofEvaluations<PointEvaluations<Vec<G::ScalarField>>>,
    pub ft_eval1: G::ScalarField,
    pub prev_challenges: Vec<RecursionChallenge<G>>,
}

The proof that the prover creates from a ProverIndex and a witness.

Fields

commitments: ProverCommitments<G>

All the polynomial commitments required in the proof

proof: OpeningProof

batched commitment opening proof

evals: ProofEvaluations<PointEvaluations<Vec<G::ScalarField>>>

Two evaluations over a number of committed polynomials

ft_eval1: G::ScalarField

Required evaluation for Maller’s optimization

prev_challenges: Vec<RecursionChallenge<G>>

Accumulators from previously verified proofs in the recursion chain.

Each RecursionChallenge stores the IPA folding challenges and accumulated commitment from verifying a previous proof. Instead of checking the IPA immediately (which requires an expensive MSM <s, G> where s has 2^k elements), we defer this check by storing the accumulator.

During verification, these accumulators are processed as follows:

1. The commitments are absorbed into the Fiat-Shamir sponge
2. The challenges are used to compute evaluations of b(X) at zeta and zeta * omega (see RecursionChallenge::evals)
3. These evaluations are paired with the commitments and included in the batched polynomial commitment check

The actual MSM verification happens in SRS::verify (see poly-commitment/src/ipa.rs), where b_poly_coefficients computes the 2^k coefficients and they are batched into a single large MSM with all other verification checks.

This design enables efficient recursive proof composition as described in Section 3.2 of the Halo paper.

Implementations

impl<G, OpeningProof, const FULL_ROUNDS: usize> ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: KimchiCurve<FULL_ROUNDS>, G::BaseField: PrimeField, OpeningProof: OpenProof<G, FULL_ROUNDS>,

pub fn create<EFqSponge, EFrSponge, RNG>( groupmap: &G::Map, witness: [Vec<G::ScalarField>; 15], runtime_tables: &[RuntimeTable<G::ScalarField>], index: &ProverIndex<FULL_ROUNDS, G, OpeningProof::SRS>, rng: &mut RNG, ) -> Result<Self, ProverError>

where EFqSponge: Clone + FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, EFrSponge: FrSponge<G::ScalarField> + From<&'static ArithmeticSpongeParams<G::ScalarField, FULL_ROUNDS>>, RNG: RngCore + CryptoRng, VerifierIndex<FULL_ROUNDS, G, OpeningProof::SRS>: Clone,

This function constructs prover’s zk-proof from the witness & the ProverIndex against SRS instance

Errors

Will give error if create_recursive process fails.

pub fn create_recursive<EFqSponge, EFrSponge, RNG>( group_map: &G::Map, witness: [Vec<G::ScalarField>; 15], runtime_tables: &[RuntimeTable<G::ScalarField>], index: &ProverIndex<FULL_ROUNDS, G, OpeningProof::SRS>, prev_challenges: Vec<RecursionChallenge<G>>, blinders: Option<[Option<PolyComm<G::ScalarField>>; 15]>, rng: &mut RNG, ) -> Result<Self, ProverError>

where EFqSponge: Clone + FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, EFrSponge: FrSponge<G::ScalarField> + From<&'static ArithmeticSpongeParams<G::ScalarField, FULL_ROUNDS>>, RNG: RngCore + CryptoRng, VerifierIndex<FULL_ROUNDS, G, OpeningProof::SRS>: Clone,

This function constructs prover’s recursive zk-proof from the witness & the ProverIndex against SRS instance

Errors

Will give error if inputs(like lookup_context.joint_lookup_table_d8) are None.

Panics

Will panic if lookup_context.joint_lookup_table_d8 is None.

impl<const FULL_ROUNDS: usize, G, OpeningProof> ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: KimchiCurve<FULL_ROUNDS>, OpeningProof: OpenProof<G, FULL_ROUNDS>, G::BaseField: PrimeField,

pub fn oracles<EFqSponge, EFrSponge, Srs>( &self, index: &VerifierIndex<FULL_ROUNDS, G, Srs>, public_comm: &PolyComm<G>, public_input: Option<&[G::ScalarField]>, ) -> Result<OraclesResult<FULL_ROUNDS, G, EFqSponge>>

where EFqSponge: Clone + FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, EFrSponge: FrSponge<G::ScalarField> + From<&'static ArithmeticSpongeParams<G::ScalarField, FULL_ROUNDS>>,

This function runs the random oracle argument

Errors

Will give error if commitment(s) are invalid(missing or wrong length), or proof is verified as invalid.

Panics

Will panic if PolishToken evaluation is invalid.

Trait Implementations

impl<G, OpeningProof, const FULL_ROUNDS: usize> Clone for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve + Clone, OpeningProof: OpenProof<G, FULL_ROUNDS> + Clone, G::ScalarField: Clone,

fn clone(&self) -> ProverProof<G, OpeningProof, FULL_ROUNDS>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<G, OpeningProof, const FULL_ROUNDS: usize> Debug for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve + Debug, OpeningProof: OpenProof<G, FULL_ROUNDS> + Debug, G::ScalarField: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, G, OpeningProof, const FULL_ROUNDS: usize> Deserialize<'de> for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve + CanonicalDeserialize + CanonicalSerialize, OpeningProof: OpenProof<G, FULL_ROUNDS> + Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<G, OpeningProof, const FULL_ROUNDS: usize> PartialEq for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve + PartialEq, OpeningProof: OpenProof<G, FULL_ROUNDS> + PartialEq, G::ScalarField: PartialEq,

fn eq(&self, other: &ProverProof<G, OpeningProof, FULL_ROUNDS>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<G, OpeningProof, const FULL_ROUNDS: usize> Serialize for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve + CanonicalDeserialize + CanonicalSerialize, OpeningProof: OpenProof<G, FULL_ROUNDS> + Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<G, OpeningProof, const FULL_ROUNDS: usize> StructuralPartialEq for ProverProof<G, OpeningProof, FULL_ROUNDS>

where G: CommitmentCurve, OpeningProof: OpenProof<G, FULL_ROUNDS>,